The Daily Index — Thursday, November 20, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

WHATSAPP SECURITY FLAW EXPOSES 3.5B USERS' DATA FROM ‘BASIC PUBLICLY AVAILABLE INFORMATION'

Austrian researchers discovered that all 3.5B WhatsApp users can be enumerated at a rate of 100M users per hour. The researchers used the WhatsApp Web interface to bulk add users and phone numbers and were able to extract phone numbers for all users, profile photos for 57% of users, and profile text for 27%. Meta implemented rate limiting to address this issue, but also stated that the data exposed was basic publicly available information.

techtimes.com · 2 min

TLDR InfoSec

W3 TOTAL CACHE WORDPRESS PLUGIN VULNERABLE TO PHP COMMAND INJECTION

WordPress security company WPScan discovered a vulnerability in the W3 Total Cache plugin that enables unauthenticated attackers to execute code by posting a comment with a malicious payload. A patch is available. WPScan is withholding proof-of-concept details until November 24 to give site owners time to update.

bleepingcomputer.com · 2 min

TLDR InfoSec

NEXT.JS SECURITY TESTING GUIDE FOR BUG HUNTERS AND PENTESTERS

Deepstrike released a detailed security guide covering common pitfalls in Next.js applications, noting that while the framework includes strong default protections against template injection and XSS, developers can introduce risk through unsafe patterns like dangerouslySetInnerHtml or third-party templating engines. The guide highlights additional attack surfaces, including SSRF via the image optimization pipeline or misconfigured server actions.

deepstrike.io · 10 min

TLDR InfoSec

SHADOWRAY 2.0: ACTIVE GLOBAL CAMPAIGN HIJACKS RAY AI INFRASTRUCTURE INTO SELF-PROPAGATING BOTNET

ShadowRay 2.0 is a malware campaign targeting Ray, a popular open-source AI framework, to hijack powerful computing clusters and convert them into a global, self-propagating botnet. Attackers exploited legitimate orchestration features within Ray, enabling them to orchestrate compute jobs, steal data, launch DDoS attacks, and autonomously spread across organizations. Attackers quickly weaponized unpatched flaws and misconfigurations in Ray clusters that were mistakenly exposed to the internet.

oligo.security · 25 min

TLDR InfoSec

SUPAPWN: HACKING OUR WAY INTO LOVABLE'S OFFICE AND HELPING SECURE SUPABASE

SupaPwn is a multi-stage exploit chain affecting outdated Supabase environments, where weaknesses in privilege controls, host configurations, and cloud credential handling allowed attackers to escalate far beyond expected tenant-level permissions, even reaching infrastructure belonging to other customers. AI tooling accelerated reconnaissance and exploit development, helping researchers validate the chain quickly. Supabase and Lovable patched all affected systems within a day, limiting impact to a small set of outdated deployments.

hacktron.ai · 23 min

TLDR InfoSec

MATE (PRODUCT LAUNCH)

Mate uses AI agents and reasoning models to automate security incident investigation and response in SOCs, reducing false positives and MTTR and enabling the SOC to learn and improve continuously.

mate.security

TLDR InfoSec

CLOUDFLARE OUTAGE ON NOVEMBER 18, 2025

Cloudflare has released its postmortem on the November 18 outage. The incident was traced to a database permissions change that caused oversized Bot Management feature files to be generated. Those files triggered repeated module crashes and widespread 5xx errors. The team initially suspected a DDoS attack, which delayed diagnosis and remediation.

blog.cloudflare.com · 12 min

TLDR InfoSec

SERVICENOW AI AGENTS CAN BE TRICKED INTO ACTING AGAINST EACH OTHER VIA SECOND-ORDER PROMPTS

ServiceNow's Now Assist AI agents can be manipulated through second-order prompt injection, where instructions passed between agents trigger unintended actions. Attackers can use this to escalate privileges, steal data, or redirect workflows. ServiceNow claims the behavior matches expected agent chaining, but organizations are urged to monitor agent interactions and harden guardrails.

thehackernews.com · 3 min

TLDR InfoSec

TENS OF THOUSANDS MORE ASUS ROUTERS PWNED BY SUSPECTED, EVOLVING CHINA OPERATION

A major cyber campaign dubbed "Operation WrtHug" has compromised around 50,000 outdated ASUS routers across Taiwan and Southeast Asia by chaining six known vulnerabilities. The activity resembles prior Chinese-linked campaigns. Researchers suspect the operation could support espionage, distinguishing it from traditional botnets by its stealthy data theft behavior.

theregister.com · 3 min

TLDR InfoSec

THUNDERBIRD ADDS NATIVE SUPPORT FOR MICROSOFT EXCHANGE ACCOUNTS

Thunderbird 145 now includes native Exchange Web Services (EWS) support, allowing users to add Microsoft Exchange accounts without relying on third-party extensions.

bleepingcomputer.com · 2 min

TLDR InfoSec

MICROSOFT TO INTEGRATE SYSMON DIRECTLY INTO WINDOWS 11, SERVER 2025

Microsoft announced that it will integrate the popular Sysmon tool directly into Windows 11 and Server 2025 next year.

bleepingcomputer.com · 2 min

TLDR InfoSec

FIVE EYES JUST MADE LIFE HARDER FOR BULLETPROOF HOSTING PROVIDERS

The US, UK, and Australia jointly sanctioned Media Land, a Russia-based bulletproof hosting provider accused of supporting major ransomware groups, including LockBit, BlackSuit, and Play.

cyberscoop.com · 2 min